User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2b6pre) Gecko/20091227 Firefox/3.5.5 Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2b6pre) Gecko/20091227 Namoroka/3.6b6pre ID:20091227053009 On Online Javascript beautifer site. When i click Beautify button, The browser does not response for a while. and returns wrong result. Reproducible: Always Steps to Reproduce: 1.Open URL ( http://jsbeautifier.org/ ) 2.Click Beautify button several time. [Alternative STR] 1.Open URL ( http://jsbeautifier.org/ ) 2.Input the Following CODE in the text box. function getElementsByXPath(xpath, node) { var nodesSnapshot = getXPathResult(xpath, node, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE); var data = []; for (var i = 0; i < nodesSnapshot.snapshotLength; i++) { data.push(nodesSnapshot.snapshotItem(i)); } return data; } 2.Click Beautify button. Actual Results: The browser is hung up for a while. And returns wrong results. Expected Results: The browser should not be hung up. This issue happens on Minefield 3.7a1pre. Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.3a1pre) Gecko/20091228 Minefield/3.7a1pre ID:20091228003819 However,the issue does not happen on Shretoko.

Regression Range: Works fine: http://hg.mozilla.org/releases/mozilla-1.9.2/rev/7f7565e06255 Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2b6pre) Gecko/20091219 Namoroka/3.6b6pre ID:20091219054015 Broken: http://hg.mozilla.org/releases/mozilla-1.9.2/rev/040104b681d8 Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2b6pre) Gecko/20091220 Namoroka/3.6b6pre ID:20091220052941 PushLog: http://hg.mozilla.org/releases/mozilla-1.9.2/pushloghtml?fromchange=7f7565e06255&tochange=040104b681d8

Regression Range in trunk: Works fine: http://hg.mozilla.org/mozilla-central/rev/65c1582465ef Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.3a1pre) Gecko/20091204 Minefield/3.7a1pre ID:20091204044732 Broken: http://hg.mozilla.org/mozilla-central/rev/d040e38c4107 Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.3a1pre) Gecko/20091205 Minefield/3.7a1pre ID:20091205042811 PushLog: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=65c1582465ef&tochange=d040e38c4107

I see this on Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.3a1pre) Gecko/20091227 Minefield/3.7a1pre

The exact changeset where this regression occurred was: changeset: 33409:040104b681d8 user: Boris Zbarsky <bzbarsky@mit.edu> date: Thu Dec 03 22:43:13 2009 -0500 summary: Bug 532823 followup. Fix where we add the 3+fp->argc. r=brendan I think this is actually a dup of bug 532568. I also think in the test case for this bug, we are reading wrong values in both the unregressed and the regressed version, but the unregressed wrong value happens not to matter in the test case.

The patch for bug 532568 fixes this on trunk.